{"action":"created","issue":{"url":"https://api.github.com/repos/nprapps/pym.js/issues/120","repository_url":"https://api.github.com/repos/nprapps/pym.js","labels_url":"https://api.github.com/repos/nprapps/pym.js/issues/120/labels{/name}","comments_url":"https://api.github.com/repos/nprapps/pym.js/issues/120/comments","events_url":"https://api.github.com/repos/nprapps/pym.js/issues/120/events","html_url":"https://github.com/nprapps/pym.js/issues/120","id":152897664,"number":120,"title":"Some hosts appear to block the `?parentUrl=` parameter for embedded pages.","user":{"login":"benlk","id":1754187,"avatar_url":"https://avatars1.githubusercontent.com/u/1754187?v=3","gravatar_id":"","url":"https://api.github.com/users/benlk","html_url":"https://github.com/benlk","followers_url":"https://api.github.com/users/benlk/followers","following_url":"https://api.github.com/users/benlk/following{/other_user}","gists_url":"https://api.github.com/users/benlk/gists{/gist_id}","starred_url":"https://api.github.com/users/benlk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benlk/subscriptions","organizations_url":"https://api.github.com/users/benlk/orgs","repos_url":"https://api.github.com/users/benlk/repos","events_url":"https://api.github.com/users/benlk/events{/privacy}","received_events_url":"https://api.github.com/users/benlk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-05-03T23:31:01Z","updated_at":"2017-03-03T12:09:57Z","closed_at":null,"body":"This ticket is a copy of [this tweet thread](https://twitter.com/benlkeith/status/727255993743249408), with added details.\n## The setting\n\nA few days ago, I was using http://f.benlk.com/inn/ie/slidertest5.html as the child in a Pym embed created using https://github.com/INN/pym-shortcode:\n\n``` html\n<div id=\"pym_0\"></div>\n<script src=\"http://insideenergy.vagrant.dev/wp-content/plugins/pym-shortcode/js/pym.js\"></script>\n<script>var pym_0 = new pym.Parent('pym_0', 'http://f.benlk.com/inn/ie/slidertest5.html', {})</script>\n```\n\nThe version of pym.js in question is from a41b140, the current master version of this repository, plus a shim method [`sendHeightToParent`](https://github.com/INN/pym-shortcode/blob/master/js/pym.js#L525-L531) for compatibility with an existing [Largo](https://github.com/INN/Largo) child theme's use of pym.js\n\nThe url generated by modern Pym for the child page on initial load is http://f.benlk.com/inn/ie/slidertest5.html?initialWidth=760&childId=pym_0&parentUrl=http%3A%2F%2Finsideenergy.vagrant.dev%2F2016%2F05%2F02%2Fpym-testing-post%2F\n## The problem\n\nWhen using the most-recent version of Pym, the embedded page returned a 403 Forbidden error.\n\nWhen using [an older version of Pym](https://bitbucket.org/projectlargo/theme-insideenergy/src/3de3e0127ab3b118d8fb5200f021e2e4a802819e/js/pym.js?fileviewer=file-view-default) dating to approximately July 7, 2014, the embedded page did not return a 403.\n\nExamination of the loaded page revealed that the newer version of Pym was setting a `parentUrl` parameter in the query string, and that the presence of this parameter was causing a 403.\n## Reproduction\n\nHere are the URLs I tried, with their status:\n\n| status | URL |\n| :-- | :-- |\n| 200 | http://f.benlk.com/inn/ie/slidertest5.html |\n| 200 | http://f.benlk.com/inn/ie/slidertest5.html?initialWidth=760&childId=pym_0 |\n| 403 | http://f.benlk.com/inn/ie/slidertest5.html?initialWidth=760&childId=pym_0&parentUrl=http%3A%2F%2Finsideenergy.vagrant.dev%2F2016%2F05%2F02%2Fpym-testing-post%2F |\n| 403 | http://f.benlk.com/inn/ie/slidertest5.html?initialWidth=760&childId=pym_0&parentUrl |\n| 403 | http://f.benlk.com/inn/ie/slidertest5.html?parentUrl |\n| 403 | http://f.benlk.com/inn/?parentUrl |\n| 200 | http://benlk.com/?parentUrl |\n\nhttp://benlk.com/ has [a `.htaccess` file with many rewrite rules](https://github.com/Circa75/dropplets/blob/29bb3e9451d1a3fe8829fd171d3edf9fc2173629/dropplets/save.php#L102-L112); http://f.benlk.com/inn/ does not have any `.htaccess` file.\n## Resolution\n\nI contacted my host and they removed _something_ that was causing the 403.\n\n![chjqm0vweae0uhr](https://cloud.githubusercontent.com/assets/1754187/15000989/d55b392c-1161-11e6-8fe9-be9491858cdc.jpg)\n\nHere's the relevant part of the chat transcript:\n\n> I replicated your error\n> I pulled the live-error log on this 403 to figure out what the cause was\n> and you're hitting a mod_security rule ID set in place by our servers for security purposes\n> It's not clear which one, so I need to continue investigating. I appreciate your patience!\n> Figured it out\n> I can whitelist it for you\n> One moment please\n> [*] Configuration good! Restarting Apache ... Done!\n\nTo recap: There was a host-specific rule being enforced by Apache's `mod_security` that was causing pages with a `parentUrl` parameter in the query to be 403'd. And it didn't apply in directories with a `.htaccess` affecting rewrite rules.\n\nA quick googling didn't find anything about mod_rewrite and `parentUrl`, so I have no idea what the rule causing this was. Hostgator's customer-facing documentation does not say anything about that parameter in specific. Here's [what the official docs have to say about mod_security](https://support.hostgator.com/articles/specialized-help/403-forbidden-or-no-permission-to-access).\n\nI don't have access to the error log that the chat technician mentioned, and the logs I do have access to don't show any data from this month. 😞 \n## Potential fixes\n\n@eads suggests [making that parameter configurable](https://twitter.com/eads/status/727589066938712064).\n"},"comment":{"url":"https://api.github.com/repos/nprapps/pym.js/issues/comments/283938223","html_url":"https://github.com/nprapps/pym.js/issues/120#issuecomment-283938223","issue_url":"https://api.github.com/repos/nprapps/pym.js/issues/120","id":283938223,"user":{"login":"jjelosua","id":1834051,"avatar_url":"https://avatars0.githubusercontent.com/u/1834051?v=3","gravatar_id":"","url":"https://api.github.com/users/jjelosua","html_url":"https://github.com/jjelosua","followers_url":"https://api.github.com/users/jjelosua/followers","following_url":"https://api.github.com/users/jjelosua/following{/other_user}","gists_url":"https://api.github.com/users/jjelosua/gists{/gist_id}","starred_url":"https://api.github.com/users/jjelosua/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jjelosua/subscriptions","organizations_url":"https://api.github.com/users/jjelosua/orgs","repos_url":"https://api.github.com/users/jjelosua/repos","events_url":"https://api.github.com/users/jjelosua/events{/privacy}","received_events_url":"https://api.github.com/users/jjelosua/received_events","type":"User","site_admin":false},"created_at":"2017-03-03T12:09:57Z","updated_at":"2017-03-03T12:09:57Z","body":"@AlainVagner @benlk @eads First of all sorry for all the silence....I am taking a look at the current issues and PRs and plan on releasing a 1.2.0 version soon (by middle march). I think we are somehow mixing two problems on the same issue. Please correct me if I am wrong.\r\n\r\n* @benlk problem was the `parentUrl` query string param name itself. we can and will make this name configurable so that it can be changed if it  conflicts with security rules on some hosting servers.\r\n* @AlainVagner problem was a matter of length of the Url, so we also need a way to `disable/override` including the parent url param however is it called in custom configurations.\r\n\r\nYour PR @AlainVagner handles the second problem but not the first since the parentUrl will be set on the url and that would generate a `403`  in the initial configuration @benlk had.\r\n\r\nI will actively work on a solution that handles both issues and release it soon. Again sorry for the long silence and thanks for helping us make Pym.js more resilient and flexible."}}
{"actor":{"display_login":"jjelosua"}}